Buggy code:
public class AuthenticationServlet extends HttpServlet { private static final AuthenticationService authService = AuthenticationServiceFactory . getService ( ) ; private static final long serialVersionUID = - 8695946617361150513L ; private static final SilverpeasSessionOpener silverpeasSessionOpener = new SilverpeasSessionOpener ( ) ; private static final String SSO_UNEXISTANT_USER_ACCOUNT = "Error_SsoOnUnexistantUserAccount" ; private static final String TECHNICAL_ISSUE = "2" ; private static final String INCORRECT_LOGIN_PWD = "1" ; private static final String INCORRECT_LOGIN_PWD_DOMAIN = "6" ; @ Override public void doPost ( HttpServletRequest servletRequest , HttpServletResponse servletResponse ) throws IOException , ServletException { HttpRequest request = HttpRequest . decorate ( servletRequest ) ; HttpSession session = request . getSession ( ) ; if ( ! ( StringUtil . isDefined ( request . getCharacterEncoding ( ) ) ) ) { request . setCharacterEncoding ( CharEncoding . UTF_8 ) ; } if ( request . isWithinAnonymousUserSession ( ) ) { <START_BUG> AuthenticationServlet . silverpeasSessionOpener . closeSession ( session ) ; <END_BUG> } ResourceLocator authenticationSettings = new ResourceLocator ( "org.silverpeas.authentication.settings.authenticationSettings" , "" ) ; boolean securedAccess = request . isSecure ( ) ; boolean isNewEncryptMode = StringUtil . isDefined ( request . getParameter ( "Var2" ) ) ; AuthenticationParameters authenticationParameters = new AuthenticationParameters ( request ) ; String domainId = getDomain ( request , authenticationParameters , authenticationSettings ) ; AuthenticationCredential credential = AuthenticationCredential . newWithAsLogin ( authenticationParameters . getLogin ( ) ) . withAsPassword ( authenticationParameters . getPassword ( ) ) . withAsDomainId ( domainId ) ; String authenticationKey = authenticate ( request , authenticationParameters , domainId ) ; String url = "" ; UserCanTryAgainToLoginVerifier userCanTryAgainToLoginVerifier = AuthenticationUserVerifierFactory . getUserCanTryAgainToLoginVerifier ( credential ) ; userCanTryAgainToLoginVerifier . clearSession ( request ) ; if ( ! ( AuthenticationServlet . authService . isInError ( authenticationKey ) ) ) { userCanTryAgainToLoginVerifier . clearCache ( ) ; if ( domainId != null ) { storeDomain ( servletResponse , domainId , securedAccess ) ; } storeLogin ( servletResponse , isNewEncryptMode , authenticationParameters . getLogin ( ) , securedAccess ) ; storePassword ( servletResponse , authenticationParameters . getStoredPassword ( ) , isNewEncryptMode , authenticationParameters . getClearPassword ( ) , securedAccess ) ; if ( ( request . getAttribute ( "skipTermsOfServiceAcceptance" ) ) == null ) { UserMustAcceptTermsOfServiceVerifier verifier = AuthenticationUserVerifierFactory . getUserMustAcceptTermsOfServiceVerifier ( credential ) ; try { verifier . verify ( ) ; } catch ( AuthenticationUserMustAcceptTermsOfService authenticationUserMustAcceptTermsOfService ) { forward ( request , servletResponse , verifier . getDestination ( request ) ) ; return ; } } MandatoryQuestionChecker checker = new MandatoryQuestionChecker ( ) ; if ( checker . check ( request , authenticationKey ) ) { forward ( request , servletResponse , checker . getDestination ( ) ) ; return ; } String absoluteUrl = AuthenticationServlet . silverpeasSessionOpener . openSession ( request , authenticationKey ) ; session = request . getSession ( false ) ; session . setAttribute ( "Silverpeas_pwdForHyperlink" , authenticationParameters . getClearPassword ( ) ) ; writeSessionCookie ( servletResponse , session , securedAccess ) ; servletResponse . sendRedirect ( servletResponse . encodeRedirectURL ( absoluteUrl ) ) ; return ; } removeStoredPassword ( servletResponse , securedAccess ) ; if ( authenticationParameters . isCasMode ( ) ) { url = "//admin//jsp//casAuthenticationError.jsp" ; } else { if ( ( ERROR_INCORRECT_LOGIN_PWD . equals ( authenticationKey ) ) || ( ERROR_INCORRECT_LOGIN_PWD_DOMAIN . equals ( authenticationKey ) ) ) { try { if ( userCanTryAgainToLoginVerifier . isActivated ( ) ) { storeLogin ( servletResponse , isNewEncryptMode , authenticationParameters . getLogin ( ) , securedAccess ) ; storeDomain ( servletResponse , domainId , securedAccess ) ; } if ( ERROR_INCORRECT_LOGIN_PWD . equals ( authenticationKey ) ) { url = userCanTryAgainToLoginVerifier . verify ( ) . performRequestUrl ( request , ( "//Login.jsp?ErrorCode=" + ( AuthenticationServlet . INCORRECT_LOGIN_PWD ) ) ) ; } else if ( ERROR_INCORRECT_LOGIN_PWD_DOMAIN . equals ( authenticationKey ) ) { url = userCanTryAgainToLoginVerifier . verify ( ) . performRequestUrl ( request , ( "//Login.jsp?ErrorCode=" + ( AuthenticationServlet . INCORRECT_LOGIN_PWD_DOMAIN ) ) ) ; } } catch ( AuthenticationNoMoreUserConnectionAttemptException e ) { url = userCanTryAgainToLoginVerifier . getErrorDestination ( ) ; } } else if ( ( ERROR_USER_ACCOUNT_BLOCKED . equals ( authenticationKey ) ) || ( ERROR_USER_ACCOUNT_DEACTIVATED . equals ( authenticationKey ) ) ) { if ( ( userCanTryAgainToLoginVerifier . isActivated ( ) ) || ( StringUtil . isDefined ( userCanTryAgainToLoginVerifier . getUser ( ) . getId ( ) ) ) ) { storeLogin ( servletResponse , isNewEncryptMode , authenticationParameters . getLogin ( ) , securedAccess ) ; storeDomain ( servletResponse , domainId , securedAccess ) ; url = AuthenticationUserVerifierFactory . getUserCanLoginVerifier ( userCanTryAgainToLoginVerifier . getUser ( ) ) . getErrorDestination ( ) ; } else { if ( ERROR_INCORRECT_LOGIN_PWD . equals ( authenticationKey ) ) { url = "//Login.jsp?ErrorCode=" + ( AuthenticationServlet . INCORRECT_LOGIN_PWD ) ; } else if ( ERROR_INCORRECT_LOGIN_PWD_DOMAIN . equals ( authenticationKey ) ) { url = "//Login.jsp?ErrorCode=" + ( AuthenticationServlet . INCORRECT_LOGIN_PWD_DOMAIN ) ; } } } else if ( ERROR_PWD_EXPIRED . equals ( authenticationKey ) ) { String allowPasswordChange = ( ( String ) ( session . getAttribute ( PASSWORD_CHANGE_ALLOWED ) ) ) ; if ( StringUtil . getBooleanValue ( allowPasswordChange ) ) { ResourceLocator settings = new ResourceLocator ( "com.silverpeas.authentication.settings.passwordExpiration" , "" ) ; url = ( ( ( ( settings . getString ( "passwordExpiredURL" ) ) + "?login=" ) + ( authenticationParameters . getLogin ( ) ) ) + "&domainId=" ) + domainId ; } else { url = "//Login.jsp?ErrorCode=" + ( AuthenticationService . ERROR_PWD_EXPIRED ) ; } } else if ( ERROR_PWD_MUST_BE_CHANGED . equals ( authenticationKey ) ) { String allowPasswordChange = ( ( String ) ( session . getAttribute ( PASSWORD_CHANGE_ALLOWED ) ) ) ; if ( StringUtil . getBooleanValue ( allowPasswordChange ) ) { ResourceLocator settings = new ResourceLocator ( "com.silverpeas.authentication.settings.passwordExpiration" , "" ) ; url = ( ( ( ( settings . getString ( "passwordExpiredURL" ) ) + "?login=" ) + ( authenticationParameters . getLogin ( ) ) ) + "&domainId=" ) + domainId ; } else { url = "//Login.jsp?ErrorCode=" + ( AuthenticationService . ERROR_PWD_EXPIRED ) ; } }

Fix:
session . invalidate ( ) ;